Telegram Scams: Fake Escrow Bots, Admin Swaps and Fake Subs

Most Telegram scams in 2026 try to get one of four things from you: your login code, your two-step verification (2FA) password, a crypto wallet approval, or a payment before anything has changed hands. Channel traders face extra tricks: fake escrow bots and middlemen, admin rights passed off as ownership, inflated subscriber counts, and fake Fragment pages for username sales.

This guide is for anyone who uses Telegram, and especially for people buying or selling channels, groups or usernames. It explains how each scam works, gives a specific way to verify the deal in front of you, and covers what to do if your account is frozen or a channel "can't be displayed."

Key takeaways

• A Telegram ownership transfer can only be started by the current owner, and documented guides say the owner's 2FA must have been on for more than 7 days and their session must be more than 24 hours old.
• Being made an admin is not the same as owning a channel, because the owner can remove an admin at any time and no admin can transfer ownership.
• Telegram channel statistics unlock at 50 subscribers as of October 2026, so a buyer can ask for a live screen share of the stats instead of trusting screenshots.
• Legitimate Fragment username sales happen on the auction itself, with no direct contact with the buyer and no fees paid outside the platform.
• A frozen Telegram account can be appealed only through the official, check-marked @SpamBot, and you should never pay an "unfreeze" service or share your login code with one.
• No genuine escrow service, middleman, verification bot or Telegram support agent needs your login code or your 2FA password.

Which Telegram scams should you watch for in 2026?

The scams that matter most to traders are fake escrow bots and middlemen, admin swaps, inflated subscribers, fake Fragment buyers, fake "Safeguard" verification bots, login-code phishing and unfreeze or recovery services. Consumer scam lists cover romance, job and investment scams well, but they mostly skip the ones that hit people trading channels.

Telegram makes impersonation cheap. Anyone can create a bot, pick a username one character away from a real one, and send a deep link that opens a page inside Telegram's in-app browser, where the address bar is easy to ignore. Telegram does offer official verification for notable accounts and added third-party verifiers in 2025, but it does not vet every new channel, so look-alike pages appear quickly.

Fake escrow bots and middlemen: how do you verify a middleman service?

Verify a middleman by finding their exact @username yourself, from a source the other party does not control, and by refusing any bot or chat opened from a link the counterparty sent. If you cannot confirm who you are dealing with independently, you are not using escrow. You are paying a stranger.

We have not found research quantifying escrow-bot impersonation, but it follows the same documented playbook as fake Safeguard and fake Fragment bots. The pattern usually looks like this: the other side suggests "the escrow bot everyone uses," sends a deep link, and the bot looks convincing. Then it asks you to deposit funds, log in, or connect a wallet. Sometimes a "middleman" joins the group chat with a username that differs from a known one by a single letter.

Before any deal, run these checks:

• Exact username: compare it character by character with the one listed on the service's own website or a source you found yourself. Watch for swapped letters, extra underscores and lookalike characters.
• Verification mark: check for Telegram's official verification where the service claims to have it, and remember that a missing mark on a "big" service is a warning.
• Who opened the chat: if the counterparty brought the middleman or the bot link, assume they control it.
• What it asks for: any request for your login code, 2FA password, seed phrase or a wallet approval ends the deal.

Fake "Safeguard" verification bots

Security researchers have documented this scam since early 2025. According to SlowMist's analysis of the fake Safeguard scam, it takes two forms. One collects your phone number, verification code and 2FA password to take over your account. The other copies malicious code to your clipboard during a fake "manual verification" step, hoping you paste and run it.

Scam Sniffer told Cointelegraph this was the first time it had seen fake X accounts, fake Telegram channels and malicious bots used together. The verification pages run on disposable free-hosting domains such as .pages.dev, .vercel.app, .netlify.app and .appspot.com, and scammers rotate them whenever one gets blocked. A real group gate will not ask you to log in to Telegram on a website.

Admin swaps: how does a real Telegram ownership transfer work?

A real transfer moves the owner role to the buyer, and only the current owner can start it. An admin swap is when a seller makes the buyer an admin, collects payment, then removes them or simply keeps ownership. An administrator cannot transfer ownership even with every admin permission switched on, so a "co-seller" who is an admin cannot hand you the channel.

As of August 2026, this step-by-step transfer guide (written for groups) documents four conditions: the recipient is already an admin with "Add New Admins" enabled, the owner's 2FA has been on for more than 7 days, the owner's current session is more than 24 hours old, and the owner enters their 2FA password to confirm. Telegram can change these rules, so treat them as the current documented process. A safe handover inside escrow looks like this:

• Step 1: The seller confirms their 2FA has been on for more than 7 days. If it was switched on yesterday, the transfer will have to wait, so agree on timing before any money moves.
• Step 2: The buyer pays into escrow, not to the seller directly.
• Step 3: The seller adds the buyer as an admin with "Add New Admins" enabled.
• Step 4: From a session older than 24 hours, the seller starts the ownership transfer and confirms it with their 2FA password.
• Step 5: The buyer checks from their own account that they now hold ownership, reviews the admin list, and removes any admins they did not agree to keep.
• Step 6: Only then does the buyer confirm delivery so the seller is paid.

Watch for invented delays. The documented method does not require the recipient to have 2FA, to have been an admin for 7 days, or the owner's account to be 6 months old. A seller who cites these as reasons to take payment now and transfer "later" is stalling. For the seller's side of the process, see how to sell a Telegram channel safely.

How can you tell if a Telegram channel has fake subscribers?

Ask the seller to open the channel's built-in Statistics on a live screen share and walk you through it. Screenshots are easy to edit. A live view of the real dashboard is much harder to fake. As of October 2026, channel statistics become available at 50 subscribers. When the feature launched in Telegram 6.0 the threshold was 1,000, so older articles that say 1,000 are out of date.

Do not rely on scrolling the member list. Telegram shows admins at most 200 subscribers there, so it tells you nothing about a 20,000-subscriber channel. On the live Statistics screen, look at three things:

• Views per post compared with subscribers: a large channel whose posts get a tiny fraction of that in views has either a dead or a purchased audience.
• The follower growth graph: sudden vertical spikes with no matching viral post or promotion often mean bulk-added subscribers.
• Notification share: the percentage of subscribers with notifications enabled. Bot-filled audiences tend to look inactive here too.

To judge whether the numbers are normal for the size and niche, compare them with our Telegram channel benchmarks or run the public channel through the Telegram channel checker before you make an offer.

Fake Fragment username sales: is someone really trying to buy my username?

Almost certainly not, if they contacted you directly. On the real Fragment, users list usernames for their accounts, groups or channels for auction and buyers bid in TON. Sellers do not need to talk to buyers, and no one asks for fees outside the platform. An unsolicited DM offering to buy your username is the classic first step of the fake Fragment scam.

Dropstab's breakdown of the fake Fragment scam describes three steps, and independent write-ups match it:

• Step 1: A "buyer" DMs you with an above-market offer and a deadline, so you feel you must act now.
• Step 2: They send a deep link to a Telegram bot, which opens a page copying Fragment's design inside Telegram's in-app browser.
• Step 3: The page asks for a "transaction fee" or a wallet connection. The approval you sign can give the attacker unlimited spending rights on your wallet, which they use to drain it.

If you want to sell a username, type fragment.com into a normal browser yourself and list it there. Never connect a wallet through a page that a stranger's bot opened.

Telegram account frozen: what it means and the scams that follow

As of September 2026, a frozen account is in read-only mode after reports from other users: you can read chats but cannot send messages or post. The freeze notice shows an appeal date, and the account is deleted if you do not appeal before it. A freeze does not lift on its own, which makes panicked users easy targets.

How to appeal safely

Tap "Submit an Appeal" on the notice, which opens Telegram's official @SpamBot. A frozen account can still message it. As this guide to the real @SpamBot explains, you can also open it from t.me/spambot, and you should look for the check mark next to its name. A similar-looking bot without the mark is fake. The real one never needs your login code, password or money.

Keep three states apart. A spam-limited account can usually still reply to people who message it first. A frozen account can be blocked from sending and posting entirely, and it is deleted if no appeal is made before the deadline. Treat a full ban as a separate case. Reinstalling Telegram or using a VPN will not remove any of these, because the restriction sits on Telegram's servers. Telegram's moderators decide appeals, so no one can promise a result.

No real escrow service, middleman, verification bot, "unban" service or Telegram support agent needs your login code, your 2FA password, or a wallet approval. A request for any of them is the scam.

Login-code phishing and fake Telegram support

Scammers posing as Telegram staff or group admins send fake security alerts with shortened links to fake login pages. These pages can capture your 2FA code or hijack your session. Telegram's guidance is that its login codes should never be shared with anyone, so treat any request for one as an account takeover attempt.

Recovery scams: the second hit

After a first loss, "recovery experts," hackers, lawyers or investigators often appear and offer to get your account or money back for an upfront fee or wallet access. These offers are usually a second scam. Our guide to account recovery scams covers the related trick where a seller reclaims an account after being paid.

"This channel can't be displayed": what does it mean for a buyer?

It means the channel is hidden from you, and the reason matters before you pay for it. Common causes include regional restrictions under local law, copyright infringement, pornographic content that breaks Telegram's Terms of Service, the sensitive-content filter, and content rules in builds installed from the App Store or Google Play. If Telegram finds a channel being used for illegal activity, it may hide or ban it.

If the only cause is the sensitive-content filter, users over 18 can switch the filter off. Ignore guides that tell you to enter your phone number into third-party bots or unofficial clients to view a hidden channel. Handing your number and code to an unknown service is exactly how accounts get taken over. Do not use a VPN to get around a legal restriction either.

For buyers, a channel that shows this message is a red flag. Ask the seller why it is hidden, check it from your own account and region, and ask them to publish a fresh post during a call so you can confirm the channel and the owner account are not frozen or limited. A restricted channel may be worth far less than its subscriber count suggests.

How escrow fits a Telegram channel deal on PlayerSells

Most of the scams above work because the money moves before ownership does. On PlayerSells, the buyer pays PlayerSells, the money is held, and the seller is paid only after the buyer confirms the channel was delivered as described. That means the ownership transfer in Step 4 above happens while the funds are still held.

Every listing is reviewed by a person before it goes live. Every deal follows a fixed sequence: offer sent, accepted, payment pending, paid, delivered, buyer confirmed, completed. Either side can open a dispute before completion, a human moderator reviews it, and the money stays held while the dispute is open. If someone in a Telegram chat claims to represent PlayerSells escrow, type playersells.com into your browser yourself and check the deal there.

See how a PlayerSells deal works, the buyer checklist in how to buy a Telegram channel safely, and our broader safety guidance. Fees are listed on the pricing page.

Frequently asked questions

Does @SpamBot work on a frozen Telegram account?

Yes. A frozen account cannot send normal messages, but it can still message @SpamBot to appeal, and the "Submit an Appeal" button on the freeze notice opens it. Check for the verification mark next to the bot's name before you type anything.

How long do I have to appeal a frozen Telegram account?

You have until the appeal date shown on your freeze notice. If you miss it, the account is deleted, so appeal as soon as you see the notice.

Does Telegram support ever ask for verification codes?

No. Telegram's guidance is that login codes should never be shared with anyone, including people who say they work for Telegram. Anyone asking for your code is trying to log in to your account.

Why did I receive a Telegram code without requesting one?

Either someone entered your phone number to try to log in, or the code came from a third-party service that delivers codes through Telegram's verified "Verification Codes" chat. In both cases, do not share it. Turn on 2FA if you have not, so a stolen code is not enough on its own.

Is Fragment a scam?

No, Fragment itself is the real auction platform for Telegram usernames, where buyers bid in TON. The scam is a fake buyer who DMs you and sends a bot link to a Fragment look-alike page. Real sales need no direct buyer contact and no fees outside the platform.

Is a Telegram escrow bot or middleman service safe to use?

Only if you verified it independently. A bot or middleman introduced by the other party, or opened from a link they sent, should be treated as theirs. Any escrow that asks for your login code, 2FA password or a wallet approval is fake.

Bottom line: verify the identity, then the asset

Before any Telegram deal, confirm who you are dealing with from a source you found yourself, confirm that ownership (not admin rights) is what you are getting, and confirm the audience on a live Statistics screen. If anyone asks for a code, a 2FA password or a wallet approval, walk away.

If you are about to buy, start with the step-by-step checklist in how to buy a Telegram channel safely and keep the money in escrow until ownership has actually moved.